2024 CVEs (page 147)
Page 147 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-48824 | High | 7.5 | 2024-10-14 | An issue in Automatic Systems Maintenance SlimLane 29565_d74ecce0c1081d50546db573a499941b10799fb7 allows a remote attacker to obtain sensitive information via… |
CVE-2024-48823 | Critical | 9.8 | 2024-10-14 | Local file inclusion in Automatic Systems Maintenance SlimLane 29565_d74ecce0c1081d50546db573a499941b10799fb7 allows a remote attacker to escalate privileges v… |
CVE-2024-48822 | High | 8.8 | 2024-10-14 | Privilege escalation in Automatic Systems Maintenance SlimLane 29565_d74ecce0c1081d50546db573a499941b10799fb7 allows a remote attacker to escalate privileges v… |
CVE-2024-48821 | Medium | 6.1 | 2024-10-14 | Cross Site Scripting vulnerability in Automatic Systems Maintenance SlimLane 29565_d74ecce0c1081d50546db573a499941b10799fb7 allows a remote attacker to escalat… |
CVE-2024-47885 | Medium | 5.9 | 2024-10-14 | The Astro web framework has a DOM Clobbering gadget in the client-side router starting in version 3.0.0 and prior to version 4.16.1. It can lead to cross-site… |
CVE-2024-48795 | Medium | 5.3 | 2024-10-14 | An issue in Creative Labs Pte Ltd com.creative.apps.xficonnect 2.00.02 allows a remote attacker to obtain sensitive information via the firmware update process. |
CVE-2024-48793 | Medium | 5.9 | 2024-10-14 | An issue in INATRONIC com.inatronic.bmw 2.7.1 allows a remote attacker to obtain sensitive information via the firmware update process. |
CVE-2024-48792 | High | 7.5 | 2024-10-14 | An issue in Hideez com.hideez 2.7.8.3 allows a remote attacker to obtain sensitive information via the firmware update process. |
CVE-2024-48791 | High | 7.5 | 2024-10-14 | An issue in Plug n Play Camera com.starvedia.mCamView.zwave 5.5.1 allows a remote attacker to obtain sensitive information via the firmware update process |
CVE-2024-48790 | Medium | 5.3 | 2024-10-14 | An issue in ILIFE com.ilife.home.global 1.8.7 allows a remote attacker to obtain sensitive information via the firmware update process. |
CVE-2024-48789 | High | 7.5 | 2024-10-14 | An issue in INATRONIC com.inatronic.drivedeck.home 2.6.23 allows a remote attacker to obtain sensitve information via the firmware update process. |
CVE-2024-47831 | Medium | 5.9 | 2024-10-14 | Next.js is a React Framework for the Web. Cersions on the 10.x, 11.x, 12.x, 13.x, and 14.x branches before version 14.2.7 contain a vulnerability in the image… |
CVE-2024-47826 | Low | 3.5 | 2024-10-14 | eLabFTW is an open source electronic lab notebook for research labs. A vulnerability in versions prior to 5.1.5 allows an attacker to inject arbitrary HTML tag… |
CVE-2024-47767 | Medium | 4.3 | 2024-10-14 | Tuleap is a tool for end to end traceability of application and system developments. Prior to Tuleap Community Edition 15.13.99.113, Tuleap Enterprise Edition… |
CVE-2024-47766 | Medium | 4.9 | 2024-10-14 | Tuleap is a tool for end to end traceability of application and system developments. Prior to Tuleap Community Edition 15.13.99.110, Tuleap Enterprise Edition… |
CVE-2024-46988 | Medium | 4.8 | 2024-10-14 | Tuleap is a tool for end to end traceability of application and system developments. Prior to Tuleap Community Edition 15.13.99.40, Tuleap Enterprise Edition 1… |
CVE-2024-46980 | Medium | 4.8 | 2024-10-14 | Tuleap is a tool for end to end traceability of application and system developments. Prior to Tuleap Community Edition 15.13.99.37, Tuleap Enterprise Edition 1… |
CVE-2024-46528 | Medium | 4.3 | 2024-10-14 | An Insecure Direct Object Reference (IDOR) vulnerability in KubeSphere 4.x before 4.1.3 and 3.x through 3.4.1 and KubeSphere Enterprise 4.x before 4.1.3 and 3… |
CVE-2024-48799 | High | 7.5 | 2024-10-14 | An issue in LOREX TECHNOLOGY INC com.lorexcorp.lorexping 1.4.22 allows a remote attacker to obtain sensitive information via the firmware update process. |
CVE-2024-48798 | High | 7.5 | 2024-10-14 | An issue in Hubble Connected (com.hubbleconnected.vervelife) 2.00.81 allows a remote attacker to obtain sensitive information via the firmware update process. |
CVE-2024-48797 | High | 7.5 | 2024-10-14 | An issue in PCS Engineering Preston Cinema (com.prestoncinema.app) 0.2.0 allows a remote attacker to obtain sensitive information via the firmware update proce… |
CVE-2024-48796 | High | 7.5 | 2024-10-14 | An issue in EQUES com.eques.plug 1.0.1 allows a remote attacker to obtain sensitive information via the firmware update process. |
CVE-2024-48168 | Critical | 9.8 | 2024-10-14 | A stack overflow vulnerability exists in the sub_402280 function of the HNAP service of D-Link DCS-960L 1.09, allowing an attacker to execute arbitrary code. |
CVE-2024-46535 | Critical | 9.8 | 2024-10-14 | Jepaas v7.2.8 was discovered to contain a SQL injection vulnerability via the orderSQL parameter at /homePortal/loadUserMsg. |
CVE-2024-45741 | Medium | 5.4 | 2024-10-14 | In Splunk Enterprise versions below 9.2.3 and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.108 and 9.1.2312.205, a low-privileged user that does not… |
CVE-2024-45740 | Medium | 5.4 | 2024-10-14 | In Splunk Enterprise versions below 9.2.3 and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403, a low-privileged user that does not hold the "admin" or… |
CVE-2024-45739 | Medium | 4.9 | 2024-10-14 | In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6, the software potentially exposes plaintext passwords for local native authentication Splunk users… |
CVE-2024-45738 | Medium | 4.9 | 2024-10-14 | In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6, the software potentially exposes sensitive HTTP parameters to the `_internal` index. This exposure… |
CVE-2024-45737 | Medium | 4.3 | 2024-10-14 | In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.108, and 9.1.2312.204, a low-privileged user that… |
CVE-2024-45736 | Medium | 6.5 | 2024-10-14 | In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.107, 9.1.2312.204, and 9.1.2312.111, a low-privil… |
CVE-2024-45735 | Medium | 4.3 | 2024-10-14 | In Splunk Enterprise versions below 9.2.3 and 9.1.6, and Splunk Secure Gateway versions on Splunk Cloud Platform versions below 3.4.259, 3.6.17, and 3.7.0, a l… |
CVE-2024-45734 | Medium | 4.3 | 2024-10-14 | In Splunk Enterprise versions 9.3.0, 9.2.3, and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could view images on the ma… |
CVE-2024-45733 | High | 8.8 | 2024-10-14 | In Splunk Enterprise for Windows versions below 9.2.3 and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could perform a R… |
CVE-2024-45732 | High | 7.1 | 2024-10-14 | In Splunk Enterprise versions below 9.3.1, and 9.2.0 versions below 9.2.3, and Splunk Cloud Platform versions below 9.2.2403.103, 9.1.2312.200, 9.1.2312.110 an… |
CVE-2024-45731 | High | 8.0 | 2024-10-14 | In Splunk Enterprise for Windows versions below 9.3.1, 9.2.3, and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could wri… |
CVE-2024-8184 | Medium | 5.9 | 2024-10-14 | There exists a security vulnerability in Jetty's ThreadLimitHandler.getRemote() which can be exploited by unauthorized users to cause remote denial-of-service… |
CVE-2024-6763 | Low | 3.7 | 2024-10-14 | Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing. The Htt… |
CVE-2024-6762 | Low | 3.1 | 2024-10-14 | Jetty PushSessionCacheFilter can be exploited by unauthenticated users to launch remote DoS attacks by exhausting the server’s memory. |
CVE-2024-48153 | Critical | 9.8 | 2024-10-14 | DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the get_subconfig funct… |
CVE-2024-48150 | Critical | 9.8 | 2024-10-14 | D-Link DIR-820L 1.05B03 has a stack overflow vulnerability in the sub_451208 function. |
CVE-2024-41997 | Medium | 6.6 | 2024-10-14 | An issue was discovered in version of Warp Terminal prior to 2024.07.18 (v0.2024.07.16.08.02). A command injection vulnerability exists in the Docker integrati… |
CVE-2024-9823 | Medium | 5.3 | 2024-10-14 | There exists a security vulnerability in Jetty's DosFilter which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack on the s… |
CVE-2024-48259 | High | 7.3 | 2024-10-14 | Cloudlog 2.6.15 allows Oqrs.php request_form SQL injection via station_id or callsign. |
CVE-2024-48257 | Critical | 9.8 | 2024-10-14 | Wavelog 1.8.5 allows Oqrs_model.php get_worked_modes station_id SQL injectioin. |
CVE-2024-48251 | Critical | 9.8 | 2024-10-14 | Wavelog 1.8.5 allows Activated_gridmap_model.php get_band_confirmed SQL injection via band, sat, propagation, or mode. |
CVE-2024-48249 | High | 7.3 | 2024-10-14 | Wavelog 1.8.5 allows Gridmap_model.php get_band_confirmed SQL injection via band, sat, propagation, or mode. |
CVE-2024-9936 | Medium | 6.5 | 2024-10-14 | When manipulating the selection node cache, an attacker may have been able to cause unexpected behavior, potentially leading to an exploitable crash. This vuln… |
CVE-2024-8602 | | 2024-10-14 | When the XML is read from the codes in the PDF and parsed using a DocumentBuilder, the default settings of the DocumentBuilder allow for an XXE (XML External E… | |
CVE-2024-7847 | High | 7.7 | 2024-10-14 | VULNERABILITY DETAILS Rockwell Automation used the latest versions of the CVSS scoring system to assess the following vulnerabilities. The following vulnerabi… |
CVE-2024-48255 | Critical | 9.8 | 2024-10-14 | Cloudlog 2.6.15 allows Oqrs.php get_station_info station_id SQL injection. |
CVE-2024-48253 | Critical | 9.8 | 2024-10-14 | Cloudlog 2.6.15 allows Oqrs.php delete_oqrs_line id SQL injection. |
CVE-2024-48120 | Medium | 5.4 | 2024-10-14 | X2CRM v8.5 is vulnerable to a stored Cross-Site Scripting (XSS) in the "Opportunities" module. An attacker can inject malicious JavaScript code into the "Name"… |
CVE-2024-48119 | Medium | 5.4 | 2024-10-14 | Vtiger CRM v8.2.0 has a HTML Injection vulnerability in the module parameter. Authenticated users can inject arbitrary HTML. |
CVE-2024-9139 | High | 7.2 | 2024-10-14 | The affected product permits OS command injection through improperly restricted commands, potentially allowing attackers to execute arbitrary code. |
CVE-2024-9137 | Critical | 9.4 | 2024-10-14 | The affected product lacks an authentication check when sending commands to the server via the Moxa service. This vulnerability allows an attacker to execute s… |
CVE-2024-46911 | Medium | 4.7 | 2024-10-14 | Cross-site Resource Forgery (CSRF), Privilege escalation vulnerability in Apache Roller. On multi-blog/user Roller websites, by default weblog owners are trust… |
CVE-2024-43701 | High | 7.8 | 2024-10-14 | Software installed and run as a non-privileged user may conduct GPU system calls to read and write freed physical memory from the GPU. |
CVE-2024-38863 | High | 7.5 | 2024-10-14 | Exposure of CSRF tokens in query parameters on specific requests in Checkmk GmbH's Checkmk versions <2.3.0p18, <2.2.0p35 and <2.1.0p48 could lead to a leak of… |
CVE-2024-38862 | Medium | 4.4 | 2024-10-14 | Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions <2.3.0p18, <2.2.0p35, <2.1.0p48 and <=2.0.0p39 (EOL) causes SNMP and IMPI s… |
CVE-2024-9924 | Critical | 9.8 | 2024-10-14 | The fix for CVE-2024-26261 was incomplete, and and the specific package for OAKlouds from Hgiga remains at risk. Unauthenticated remote attackers still can dow… |
CVE-2024-9923 | Medium | 4.9 | 2024-10-14 | The Team+ from TEAMPLUS TECHNOLOGY does not properly validate a specific page parameter, allowing remote attackers with administrator privileges to move arbitr… |
CVE-2024-49214 | Medium | 5.3 | 2024-10-14 | QUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening a 0-RTT session with a spoofed IP address. This can bypass th… |
CVE-2024-9922 | High | 7.5 | 2024-10-14 | The Team+ from TEAMPLUS TECHNOLOGY does not properly validate a specific page parameter, allowing unauthenticated remote attackers to exploit this vulnerabilit… |
CVE-2024-9921 | Critical | 9.8 | 2024-10-14 | The Team+ from TEAMPLUS TECHNOLOGY does not properly validate specific page parameter, allowing unauthenticated remote attackers to inject arbitrary SQL comman… |
CVE-2024-7099 | Critical | 9.8 | 2024-10-13 | netease-youdao/qanything version 1.4.1 contains a vulnerability where unsafe data obtained from user input is concatenated in SQL queries, leading to SQL injec… |
CVE-2024-9918 | Medium | 4.7 | 2024-10-13 | A vulnerability has been found in HuangDou UTCMS V9 and classified as critical. This vulnerability affects the function RunSql of the file app/modules/ut-data/… |
CVE-2024-9917 | Medium | 6.3 | 2024-10-13 | A vulnerability, which was classified as critical, was found in HuangDou UTCMS V9. This affects an unknown part of the file app/modules/ut-template/admin/templ… |
CVE-2024-8070 | High | 8.5 | 2024-10-13 | CWE-312: Cleartext Storage of Sensitive Information vulnerability exists that exposes test credentials in the firmware binary |
CVE-2024-9916 | High | 7.3 | 2024-10-13 | A vulnerability, which was classified as critical, has been found in HuangDou UTCMS V9. Affected by this issue is some unknown functionality of the file app/mo… |
CVE-2024-9915 | High | 8.8 | 2024-10-13 | A vulnerability classified as critical was found in D-Link DIR-619L B1 2.06. Affected by this vulnerability is the function formVirtualServ of the file /goform… |
CVE-2024-9914 | High | 8.8 | 2024-10-13 | A vulnerability classified as critical has been found in D-Link DIR-619L B1 2.06. Affected is the function formSetWizardSelectMode of the file /goform/formSetW… |
CVE-2024-9913 | High | 8.8 | 2024-10-13 | A vulnerability was found in D-Link DIR-619L B1 2.06. It has been rated as critical. This issue affects the function formSetRoute of the file /goform/formSetRo… |
CVE-2024-9912 | High | 8.8 | 2024-10-13 | A vulnerability was found in D-Link DIR-619L B1 2.06. It has been declared as critical. This vulnerability affects the function formSetQoS of the file /goform/… |
CVE-2024-9911 | High | 8.8 | 2024-10-13 | A vulnerability was found in D-Link DIR-619L B1 2.06. It has been classified as critical. This affects the function formSetPortTr of the file /goform/formSetPo… |
CVE-2024-9910 | High | 8.8 | 2024-10-13 | A vulnerability was found in D-Link DIR-619L B1 2.06 and classified as critical. Affected by this issue is the function formSetPassword of the file /goform/for… |
CVE-2024-9909 | High | 8.8 | 2024-10-13 | A vulnerability has been found in D-Link DIR-619L B1 2.06 and classified as critical. Affected by this vulnerability is the function formSetMuti of the file /g… |
CVE-2024-6959 | High | 7.1 | 2024-10-13 | A vulnerability in parisneo/lollms-webui version 9.8 allows for a Denial of Service (DOS) attack when uploading an audio file. If an attacker appends a large n… |
CVE-2024-9908 | Medium | 5.5 | 2024-10-13 | A vulnerability, which was classified as critical, was found in D-Link DIR-619L B1 2.06. Affected is the function formSetMACFilter of the file /goform/formSetM… |
CVE-2024-9907 | Low | 3.7 | 2024-10-13 | A vulnerability classified as problematic was found in QileCMS up to 1.1.3. This vulnerability affects the function sendEmail of the file /qilecms/user/control… |
CVE-2024-9906 | Low | 3.5 | 2024-10-13 | A vulnerability, which was classified as problematic, was found in SourceCodester Online Eyewear Shop 1.0. Affected is an unknown function of the file /admin/?… |
CVE-2024-9905 | Medium | 6.3 | 2024-10-13 | A vulnerability, which was classified as critical, has been found in SourceCodester Online Eyewear Shop 1.0. This issue affects some unknown processing of the… |
CVE-2024-9904 | Medium | 4.7 | 2024-10-13 | A vulnerability classified as critical was found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 1.2.0. This vulnerability affects the function pictureUpload of the… |
CVE-2024-9903 | Medium | 4.7 | 2024-10-12 | A vulnerability classified as critical has been found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 1.2.0. This affects the function fileUpload of the file /admin/… |
CVE-2024-49193 | High | 7.5 | 2024-10-12 | Zendesk before 2024-07-02 allows remote attackers to read ticket history via e-mail spoofing, because Cc fields are extracted from incoming e-mail messages and… |
CVE-2024-9894 | Medium | 6.3 | 2024-10-12 | A vulnerability, which was classified as critical, was found in code-projects Blood Bank System 1.0. Affected is an unknown function of the file reset.php. The… |
CVE-2024-8902 | Medium | 4.3 | 2024-10-12 | The Elementor Addon Elements plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13.8 via the render_c… |
CVE-2024-8757 | High | 7.2 | 2024-10-12 | The WP Post Author – Boost Your Blog's Engagement with Author Box, Social Links, Co-Authors, Guest Authors, Post Rating System, and Custom User Registrati… |
CVE-2024-9696 | Medium | 6.4 | 2024-10-12 | The Rescue Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'rescue_tab' shortcode in all versions up to, and incl… |
CVE-2024-9595 | Medium | 6.4 | 2024-10-12 | The TablePress – Tables in WordPress made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the table cell content in all versions up… |
CVE-2024-8915 | Medium | 6.4 | 2024-10-12 | The Category Icon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to ins… |
CVE-2024-8760 | Medium | 5.3 | 2024-10-12 | The Stackable – Page Builder Gutenberg Blocks plugin for WordPress is vulnerable to CSS Injection in all versions up to, and including, 3.13.6. This makes it p… |
CVE-2024-9756 | Medium | 4.3 | 2024-10-12 | The Order Attachments for WooCommerce plugin for WordPress is vulnerable to unauthorized limited arbitrary file uploads due to a missing capability check on th… |
CVE-2024-9704 | Medium | 6.4 | 2024-10-12 | The Social Sharing (by Danny) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dvk_social_sharing' shortcode in all versions… |
CVE-2024-9047 | Critical | 9.8 | 2024-10-12 | The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.11 via wfu_file_downloader.php. This… |
CVE-2024-9824 | Medium | 4.3 | 2024-10-12 | The ImagePress – Image Gallery plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'ip_de… |
CVE-2024-9778 | Medium | 4.3 | 2024-10-12 | The ImagePress – Image Gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.2. This is due to mis… |
CVE-2024-9776 | Medium | 4.4 | 2024-10-12 | The ImagePress – Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.2… |
CVE-2024-9670 | Medium | 6.1 | 2024-10-12 | The 2D Tag Cloud plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL i… |
CVE-2024-9656 | Medium | 6.4 | 2024-10-12 | The Mynx Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 0.27.8 due t… |
CVE-2024-9187 | Medium | 4.3 | 2024-10-12 | The Read more By Adam plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the deleteRm() function in all versi… |